Privacy
What we don't do
- No accounts.
- No ads.
- One outside analytics service, Google Analytics (described below). No other trackers, no social widgets. Everything else here is recorded by our own server.
- We don't sell what we record, or share it except as described on this page.
What we record to improve the site
We keep simple usage statistics so we can see what people search for, where they get stuck, and whether the site is fast enough. They feed one internal report a day.
- A visitor cookie. A random ID in a first-party cookie named
ssv, kept for a year. It contains nothing about you; it only lets us tell new visitors from returning ones and group visits into sessions (a session ends after 30 minutes without activity). You can block or delete it and the site works the same. - A home-page ideas cookie. When you press “Show more suggested searches” on the home page, a first-party cookie named
ss_ideasremembers which suggested searches are on your list (their numbers only), so going back to the home page shows the same ones. It lasts until you close your browser. - Each page you open (and each API request): the time, the page address without its search text, whether it loaded and how long it took, the website that linked you here (its domain only), a browser category (a person, a search-engine crawler, another crawler, or an automated tool), and your country. Country is looked up from your IP address in a database on our own server; the IP address is not stored with these records. Claimed Google and Bing crawlers are checked by looking up their IP addresses.
- Searches: the text you search for, including questions in plain English, the kind of search, how many results it found, and how long it took.
- Some actions: opening year tabs and pop-ups, using a Copy button, downloading a CSV, opening leaderboards and share images, opening Support us, starting a support payment (the amount chosen), and sending the contact form (its topic only, never its contents).
These records are deleted after 90 days. For each visitor ID we also keep the dates of its first and latest visit, deleted a year after the latest one (the cookie's lifetime). We keep daily totals, the most viewed pages and referring sites, and the day's most common searches (including searches that found nothing) longer, without visitor IDs.
To write the daily report, those daily totals, pages, referring sites and common searches (never visitor IDs or IP addresses) are sent to Anthropic's API, where a Claude language model writes a short summary for us.
Google Analytics
We also use Google Analytics, a service of Google LLC, to see how people use the site. Every page loads Google's script, which sets cookies named _ga and _ga_SVNDZGJ06B (kept up to two years) and sends Google the address of the page you're on (including any search text in it), the page that linked you here, your browser and device type, your approximate location, and what you do on the page. Google says Google Analytics doesn't log or store IP addresses. Google's privacy policy covers what Google does with it.
You can turn it off with your browser's cookie or tracker settings, an ad or tracker blocker, or Google's opt-out add-on. The site works the same without it.
What the server logs
The web server keeps standard access logs: IP address, time, the page requested (which includes any name you search for, since searches are part of the address) and your browser's user agent. A second log records the same details, plus how long the page took, for requests that say they are Google's or Bing's crawlers. Logs are deleted after 14 days. They are used only to keep the site running, stop abuse, and check how search engines see the site.
Support payments
If you support the site, Stripe processes the payment on its own page; we never see or store your card number. Stripe shares your name, email and the amount with us, so receipts and monthly support can be managed in our Stripe account. Our server keeps only Stripe's event records (ids, amounts and statuses), not your name or email.
Where the data comes from
Everything shown about people and organizations comes from public IRS filings. See Data.
Ask in plain English
When you type a question (a sentence rather than a name) in the search box or on Ask, its text is sent to Anthropic's API (a Claude language model) only to turn it into one of our searches. Nothing else is sent: no IP address, no cookies, no results. Plain name searches are not sent to anyone. Like every search, the question is also recorded in our usage statistics (above) for 90 days. So that repeat questions are fast, we keep the structured search a question became (for example “people at the Red Cross”), filed under a one-way code of the question rather than its text, for up to a day, then delete it. IP addresses are kept only as long as the rate limit needs them (an hour), in memory. We also count how many questions are asked each day.
The Get Ideas email
If you sign up for Get Ideas, we keep your email address, when you signed up and confirmed, and which suggestions we sent you each day, only to send that email. Nothing is added until you click the confirmation link. Unsubscribing stops the email at once; we keep the address marked as unsubscribed so it isn't mailed again. Email is sent through Postmark. We don't track opens or clicks, and we never share or sell the list.
The contact form
The contact form sends an email to us. Beyond that email we keep only a count of messages by topic: no database of messages. Your IP address is used only for rate limiting and spam control; the email we receive shows only the first part of it (your network, not your address). If our mail service is down, the message is held on the server until we can read it, then deleted.
Corrections
If something shown here is wrong, use the contact form or email corrections@furp.org with the page address and what is wrong. Removal requests go to the same place. If the error is in the filing itself, the organization has to amend its return with the IRS; we can note the problem in the meantime.